some refinement

semgrep-rules.yml

@@ -0,0 +1,27 @@
+rules:
+  - id: go-otel-span-end-defer
+    message: "Potential missing `defer span.End()`. Spans should be closed to avoid memory leaks."
+    languages: [go]
+    severity: WARNING
+    patterns:
+      - pattern: |
+          $SPAN, $ERR := $TRACER.Start(...)
+          ...
+      - pattern-not: |
+          $SPAN, $ERR := $TRACER.Start(...)
+          defer $SPAN.End()
+          ...
+      - pattern-not: |
+          $SPAN, $ERR := $TRACER.Start(...)
+          ...
+          $SPAN.End()
+
+  - id: no-direct-log-fatal
+    message: "Avoid using `log.Fatal` in internal packages. Use errors to propagate up to main."
+    languages: [go]
+    severity: ERROR
+    pattern: log.Fatal(...)
+    paths:
+      exclude:
+        - "main.go"
+        - "cmd/**"